SQL Injection

Every one of the 48 is a mark on the map. Named now: 1 to 26, most at risk first.

1. GLPI < 10.0.17 - Pre-Auth SQL InjectionCVE-2025-24799glpi-project · CVSS 7.5 · 87% likelycovered by CyberSIXT

   CWE-89

2. GLPI 10.0.10-10.0.14 - SQL InjectionCVE-2024-29889glpi-project · CVSS 7.1 · 65% likely

   CWE-89

3. GLPI - Blind SQL Injection in History Log Filter (LogBleed)CVE-2026-53629glpi-project · CVSS 7.1 · 1.0% likely

   CWE-89

4. GLPI SQL injection through inventory agent requestCVE-2023-46727glpi-project · CVSS 8.6 · 68% likely

   CWE-89

5. GLPI contains an authenticated SQL injectionCVE-2024-31456glpi-project · CVSS 7.7 · 59% likely

   CWE-89

6. SQL Injection in through the search engineCVE-2024-27096glpi-project · CVSS 7.7 · 59% likely

   CWE-89

7. GLPI vulnerable to SQL injection via inventory agent requestCVE-2023-35924glpi-project · CVSS 8.6 · 52% likely

   CWE-89

8. SQL injection on login page in GLPICVE-2022-31061glpi-project · CVSS 9.8 · 51% likely

   CWE-89

9. GLPI vulnerable to SQL injection through Computer Virtual Machine informationCVE-2023-36808glpi-project · CVSS 8.6 · 48% likely

   CWE-89

10. GLPI allows account takeover via SQL Injection in AJAX scriptsCVE-2024-40638glpi-project · CVSS 8.1 · 38% likely

    CWE-89

11. SQL Injection on REST API in GLPICVE-2022-39323glpi-project · CVSS 7.4 · 37% likely

    CWE-89

12. Account takeover via SQL Injection in UI layout preferences in GLPICVE-2023-41320glpi-project · CVSS 8.1 · 36% likely

    CWE-89

13. glpi Authenticated SQL InjectionCVE-2023-43813glpi-project · CVSS 6.5 · 31% likely

    CWE-89

14. GLPI allows account takeover via SQL Injection in AJAX scriptsCVE-2024-37148glpi-project · CVSS 8.1 · 20% likely

    CWE-89

15. SQL injection with _actor parameter in GLPICVE-2022-31056glpi-project · CVSS 9.8 · 9.9% likely

    CWE-89

16. GLPI has an Unauthenticated SQL Injection via Search engineCVE-2026-26263glpi-project · CVSS 8.1 · 8.4% likely

    CWE-89

17. GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL InjectionCVE-2025-32786glpi-project · CVSS 7.5 · 7.0% likely

    CWE-89

18. SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter.CVE-2014-9258Glpi-Project · 3.4% likely

    CWE-89

19. Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users_id_assign parameter to ajax/ticketassigninf…CVE-2013-2226Glpi-Project · 2.7% likely

    CWE-89

20. A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated.CVE-2021-44617Glpi-Project · 2.1% likely

    CWE-89

21. SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter.CVE-2017-11184Glpi-Project · 1.8% likely

    CWE-89

22. GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php.CVE-2017-11474Glpi-Project · 1.6% likely

    CWE-89

23. Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain character when the database is co…CVE-2016-7508Glpi-Project · 1.6% likely

    CWE-89

24. GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php.CVE-2017-11475Glpi-Project · 1.4% likely

    CWE-89

25. GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers.CVE-2017-11329Glpi-Project · 1.2% likely

    CWE-89

26. SQL Injection in glpiCVE-2020-15108glpi-project · CVSS 7.1 · 1.2% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.